Robust alarm system

ABSTRACT

A robust alarm system has an alarm controller adapted to input an alarm trigger and to generate at least one alarm drive signal in response. Alarm subsystems input the alarm drive signal and activate one or more of multiple alarms accordingly. A subsystem function signal provides feedback to the alarm controller as to alarm subsystem integrity. A malfunction indicator is output from the alarm controller in response to a failure within the alarm subsystems.

Any and all applications for which a foreign or domestic priority claimis identified in the Application Data Sheet as filed with the presentapplication are hereby incorporated by reference under 37 CFR 1.57.

BACKGROUND OF THE INVENTION

Physiological measurement systems employed in healthcare often featurevisual and audible alarm mechanisms that alert a caregiver when apatient's vital signs are outside of predetermined limits. For example,FIG. 1 illustrates a pulse oximeter, which measures the oxygensaturation level of arterial blood, an indicator of oxygen supply. Atypical pulse oximetry system 100 has a sensor 101 that provides asensor signal 162 to a pulse oximeter (monitor) 102. The sensor 101 hasemitters 110 and a detector 120 and is attached to a patient at aselected fleshy tissue site, such as a fingertip. The emitters 110transmit light having red and IR wavelengths into the tissue site. Thedetector 120 generates the sensor signal 162 in response to theintensity of the emitter transmitted light after attenuation bypulsatile blood flow within the tissue site A pulse oximetry sensor isdescribed in U.S. Pat. No. 6,088,607 entitled Low Noise Optical Probe,which is assigned to Masimo Corporation, Irvine, Calif. and incorporatedby reference herein.

The monitor 102 has drivers 140, a controller 150 and a front-end 160.The drivers 140 activate the emitters 110 according to the controller150, and the front-end 160 conditions and digitizes the resulting sensorsignal 162. The monitor 102 also has a signal processor 170, a display180 and an alarm 190. The signal processor 170 inputs the conditionedand digitized sensor signal 164 and calculates oxygen saturation alongwith pulse rate, as is well-known in the art. The display 180 provides anumerical readout of a patient's oxygen saturation and pulse rate. Thealarm 190 provides an audible indication when oxygen saturation or pulserate are outside of preset limits. A pulse oximetry monitor is describedin U.S. Pat. No. 5,482,036 entitled Signal Processing Apparatus andMethod, which is assigned to Masimo Corporation, Irvine, Calif. andincorporated by reference herein.

SUMMARY OF THE INVENTION

Alarm reliability is a critical requirement for physiologicalmeasurement systems employed in healthcare. An alarm failure may resultin patient injury or death. A robust alarm system provides at least oneof redundant alarms, drive circuit integrity checks and alarm integritychecks so as to increase alarm reliability.

One aspect of a robust alarm system comprises an alarm controlleradapted to input an alarm trigger and generate at least one alarm drivesignal in response. Alarm subsystems are adapted to input the alarmdrive signal and activate alarms in response. A subsystem functionsignal is output from the alarm subsystems to the alarm controller so asto indicate the integrity of the alarm subsystems. A malfunctionindicator is output from the alarm controller in response to a failurewithin the alarm subsystems.

In one embodiment, the alarm subsystems have one or more of a driver, acircuit tester and an alarm detector. The driver and a correspondingdrive circuit actuates one or more alarms in response to the alarm drivesignal. A circuit tester verifies the integrity of the driver and drivecircuit. An alarm detector verifies the integrity of at least one of thealarms. Alarm detection may be based upon detecting emitted sound wavesor by detecting alarm transducer movement or vibration utilizingultrasound, optical or piezoelectric sensors to name a few.

Another aspect of a robust alarm system comprises a processor responsiveto a sensor so as to initiate an alarm trigger based upon aphysiological event. A controller is responsive to the alarm trigger soas to generate at least one alarm drive signal. Multiple alarms are incommunication with the alarm drive signal so as to concurrently indicatethe physiological event.

A further aspect of a robust alarm system is a method where opticalradiation having at least two wavelengths is transmitted into a tissuesite. A sensor signal is provided in responsive to attenuation of theoptical radiation by pulsatile blood flowing within the tissue site. Aphysiological parameter measurement is derived from the sensor signal,and an alarm trigger is generated in response to the measurement beingoutside of predetermined limits for the parameter. Multiple alarms areconcurrently activated in response to the alarm trigger.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 is a block diagram of a conventional pulse oximeter;

FIG. 2 is a block diagram of a physiological measurement system having arobust alarm system;

FIG. 3 is a block diagram of a robust alarm system;

FIG. 4 is a schematic diagram of a drive circuit tester;

FIG. 5 is a block diagram of an acoustic sensor of alarm integrity;

FIG. 6 is a block diagram of a piezoelectric sensor of alarm integrity;

FIG. 7 is a block diagram of a ultrasound sensor of alarm integrity;

FIG. 8 is a block diagram of an optical sensor of alarm integrity;

FIG. 9 is a block diagram of an tandem speaker coil sensor of alarmintegrity; and

FIG. 10 is a block diagram of a pulse oximeter comprising a portableinstrument, and corresponding docking station incorporating a robustalarm system.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

FIG. 2 illustrates a physiological measurement system 200 having arobust alarm system 300. The physiological measurement system 200 has asignal processor 210 responsive to an input sensor signal 212 and adisplay 220 for presenting the results. For example, the signalprocessor 210 may be part of a pulse oximetry monitor that is responsiveto an intensity signal from an optical sensor, as described above.Likewise, the display 220 may provide a numerical indication of oxygensaturation and pulse rate calculated accordingly. Unlike a conventionalalarm 190 (FIG. 1), however, the robust alarm system 300 advantageouslyhas redundant alarms and alarm system integrity checks, as describedbelow.

As shown in FIG. 2, the signal processor 210 inputs the sensor signal212 and generates an alarm trigger 214 in response, such as when aparameter calculated by the signal processor is outside of predeterminedlimits. The alarm system 300 inputs the alarm trigger signal 214 andactivates one or more alarms accordingly, as described below. In oneembodiment, the alarm system 300 also outputs a malfunction signal 216,which indicates that one or more alarm subsystems 301-303 areunresponsive, i.e. are not generating an alarm in response to the alarmtrigger 214. In one embodiment, the malfunction signal 216 is output tothe signal processor 210, which may trigger a malfunction indication onthe display 220 or trigger a separate malfunction indicator 230, orboth. In another embodiment, the malfunction signal 216 is outputdirectly to the malfunction indicator 230. The malfunction indicator 230may be an audible alert, visual alert or alert signal. An audible alert,for example, may be an alarm, buzzer, recorded or synthesized voice toname a few. A visual alert may be a flashing light or display message,for example. An alert signal may be, for instance, an electronic signal,code or message sent to another system via wired or wirelesscommunication channels, or local area or wide area networks, to name afew.

Also shown in FIG. 2, the robust alarm system 300 has an alarmcontroller 310 and one or more alarm subsystems 301-303. The alarmcontroller 310 inputs the alarm trigger 310 and activates an alarmsubsystem 301-303 or multiple alarm subsystems concurrently. The alarmcontroller 310 also receives a subsystem function signal 305 thatprovides feedback to the alarm controller 310 as to the integrity of thealarm subsystems 301-303. In one embodiment, the subsystem functionsignal 305 comprises circuit function signals 332 (FIG. 3) or alarmfunction signals 352 (FIG. 3) or both, as described with respect to FIG.3, below. The alarm controller 310 generates the malfunction signal 216if alarm subsystem integrity has been compromised. In one embodiment,the malfunction signal 216 is encoded or otherwise configured so as toindicate a particular fault type or fault location or both. The faultlocation may be subsystem, component or subcomponent specific. In aparticular embodiment, the alarm controller 310 may activate ordeactivate one or more alarm subsystems 301-303 in response to thesubsystem function signal 305 so as to work around one or more faultyalarm subsystems 301-303. In various embodiments, the alarm controller310 may comprise separate hardware, software or firmware components ormay be integrated with the signal processor 210. A robust alarm system300 may be incorporated into a pulse oximeter, such as is described indetail with respect to FIG. 10, below.

Further shown in FIG. 2, the robust alarm system 300 can be configuredfor various self-testing, fault correction and alarm condition response.In one embodiment, two or more alarm subsystems 301-303 can beconcurrently activated so that multiple alarms sound simultaneously andso that failure of any one alarm or alarm subsystem 301-303 will notresult in silence during an alarm condition. These multiple alarms mayeach sound at different frequencies or frequency spectra so as tofacilitate alarm failure recognition and troubleshooting. In anotherembodiment, the alarm controller 310 deactivates a failing alarmsubsystem 301-303 and activates one or more redundant alarm subsystems301-303 in response to the subsystem function signal 305. In yet anotherembodiment, the alarm controller 310 initiates alarm subsystem testingin the absence of an alarm condition by intermittently activating thealarm subsystems 301-303. In particular embodiments, intermittent testalarms are activated only long enough for subsystem function 305feedback or at frequencies outside of a normal hearing range so as to beessentially unnoticeable by caregivers, patients or other personneloperating the physiological measurement system 200.

FIG. 3 illustrates a robust alarm system 300 having an alarm controller310, drivers 320, circuit testers 330, alarms 340 and detectors 350. Thealarm controller 310 responds to the alarm trigger 214 by outputtingdrive signals 312 to one or more drivers 320 so as to activate one ormore of the alarms 340. The alarms 340 may be any of various audibletransducers, such as speakers, piezoelectric transducers, buzzers orbells to name a few.

As shown in FIG. 3, circuit testers 330 are in electrical communicationwith the drivers 320 so as to verify the integrity of the drive circuitsbetween the drivers 320 and the alarms 340. Circuit testers 330 provideone or more circuit function signals 332 to the alarm controller 310,which the alarm controller 310 utilizes to indicate and adapt tosubsystem malfunctions, as described above. A circuit tester embodimentis described with respect to FIG. 4, below.

Also shown in FIG. 3, alarm detectors 350 interface with the alarms 340so as to verify the integrity of the alarm transducers. Alarm detectors350 provide one or more alarm function signals 352 to the alarmcontroller 310, which the alarm controller 310 utilizes to indicate andadapt to subsystem malfunctions, as described above. Alarm detectorembodiments are described with respect to FIGS. 5-9, below.

In one embodiment, each alarm 340 has a corresponding alarm detector 350so that the alarm controller 310 can identify a specific malfunctioningalarm. In another embodiment, a robust alarm system 300 may have onealarm detector 350 for multiple alarms 340 that each output a uniqueaudio frequency or frequency spectrum so as to distinguish amalfunctioning alarm. In yet another embodiment, a robust alarm system300 may have one alarm detector 350 for all alarms 340, where each alarmis sequentially and briefly activated during a periodic or intermittenttesting procedure so as to determine the existence of any malfunctioningalarms. In this manner, the detector 350 provides the alarm controller310 with sequential alarm function signals 352. Advantageously, acombination of alarm redundancy, a drive circuit integrity check and analarm integrity check increases overall alarm reliability.

FIG. 4 illustrates a driver embodiment 420 and a corresponding circuittester embodiment 430. The driver 420 comprises an oscillator 422responsive to a drive signal 312 and a power amplifier 424 that drives aspeaker 440. An alarm sounds when the alarm controller 310 (FIG. 3)activates the drive signal 312 and the speaker 440 generates a tone atthe oscillator frequency. The circuit tester 430 comprises a resistor R432 and a differential amplifier 434. The resistor 432 senses the poweramplifier current flowing through the speaker coil, and the differentialamplifier 434 amplifies the corresponding voltage drop across theresistor 422 providing a square wave, for example, as a circuit functionsignal 332 to the alarm controller 310 (FIG. 3). The alarm controller310 (FIG. 3) verifies the integrity of the circuit between driver 420and alarm 440 by sensing a square wave in the circuit function signal332 when the drive signal 312 is active. Likewise, the alarm controller310 (FIG. 3) senses a circuit malfunction if the circuit function signal332 is a DC level or random noise when the drive signal 312 is active,such as when the tone generator or power amplifier are non-functional orwhen the drive circuit is open loop due to coil wire breakage. Thecircuit tester 430, however, cannot verify alarm integrity, i.e. thatthe speaker 440 is actually generating sound in response to drivecurrent through an intact speaker coil. For example, the speaker conemay be detached from the speaker coil or otherwise damaged. Alarmdetectors 350 (FIG. 3) that can verify alarm integrity are describedwith respect to FIGS. 5-9, below.

FIG. 5 illustrates one embodiment of an alarm detector 350 (FIG. 3) thatcan verify alarm integrity. An acoustic sensor 550, such as amicrophone, is configured to detect sound waves 501 generated by thealarm transducer 340 (FIG. 3), such as a speaker. An amplifier 510generates a corresponding alarm function signal 352 to the alarmcontroller 310 (FIG. 3). If the alarm 540 is operative, the alarmcontroller 310 (FIG. 3) can detect a corresponding tone waveform in thealarm function signal 352 upon activation of the drive signal 312 (FIG.3). Otherwise, an alarm malfunction is determined and the alarmcontroller 310 (FIG. 3) responds accordingly, such as generating amalfunction signal 216 (FIG. 3) or activating a redundant alarm 340(FIG. 3) or both.

FIG. 6 illustrates another embodiment of an alarm detector 350 (FIG. 3).A piezoelectric device 650 is configured to sense vibrations from afunctioning acoustic transducer, such as a speaker 640. In particular,the piezoelectric device 650 is attached to or otherwise mechanicallycoupled to an acoustic transducer, such as a speaker 640. If the alarm640 is operative, the alarm controller 310 (FIG. 3) can detect acorresponding vibration waveform in the alarm function signal 352 uponactivation of the drive signal 312 (FIG. 3). Otherwise, an alarmmalfunction is determined and the alarm controller 310 (FIG. 3) respondsaccordingly.

FIG. 7 illustrates a further embodiment of an alarm detector 350 (FIG.3). An ultrasound transmitter 760 and corresponding ultrasound receiver750 are configured to sense movement from a functioning acoustictransducer, such a speaker 740. In particular, the transmitter 760 isadapted to transmit an ultrasound wave 701 to the speaker cone 742. Thereceiver 750 is adapted to measure a return ultrasound wave 702reflected off of the cone 742. If the speaker cone 742 is in motion, thereturn ultrasound wave 702 is phase shifted from the transmittedultrasound wave 701 due to changes in the ultrasound wave path lengthand frequency shifted due to the Doppler effect. If the speaker cone 742is motionless, the return ultrasound wave 702 is a steady sinusoidalwith the same frequency as the transmitted ultrasound wave 701. Thus, ifthe alarm 740 is operative, the alarm controller 310 (FIG. 3) can detectthese phase and frequency shifts as reflected in the alarm functionsignal 352 upon activation of the drive signal 312 (FIG. 3). Otherwise,an alarm malfunction is determined and the alarm controller 310 (FIG. 3)responds accordingly.

FIG. 8 illustrates yet another embodiment of an alarm detector 350 (FIG.3). An LED emitter 860 and a photodiode sensor 850 are configured tosense movement from a functioning acoustic transducer, such a speaker840. In particular, a DC signal is applied to the LED 840, which isadapted to emit light 801 so as to illuminate a portion of the speakercone 842. The photodiode 850 is adapted to detect the intensity of lightreflected 802 off of the speaker cone 842. If the speaker cone 842 is inmotion, the light intensity at the photodiode 850 will have an ACcomponent because of changes that occur in the LED-photodiode focalpoint and optical path. Further, if the speaker cone 842 has smallexcursions, the AC component of the light intensity at photodiode willhave a frequency spectra corresponding to that of the speaker 840, whichallows the sound frequency spectra generated by the speaker 840 to beverified. If the speaker cone 842 is motionless, the light intensity atthe photodiode will be a DC value. Thus, if the alarm 840 is operative,the alarm controller 310 (FIG. 3) can detect these phase and frequencyshifts as reflected in the alarm function signal 352 upon activation ofthe drive signal 312 (FIG. 3). Otherwise, an alarm malfunction isdetermined and the alarm controller 310 (FIG. 3) responds accordingly.In an alternative embodiment, a modulated signal is applied to the LED860 and a corresponding demodulation is applied to the photodiode 850 soas to detect the AC component due to speaker cone motion.

FIG. 9 illustrates an additional embodiment of an alarm detector 350(FIG. 3). A sensing coil 944 is configured to sense movement in afunctioning acoustic transducer, such a speaker 940. In particular, thesensing coil 944 is placed in tandem with the speaker coil 942 so thatmovement of the speaker cone resulting from drive current in the speakercoil 942 induces current in the sensing coil 944. That is, movement ofthe sensing coil 944 through the field of the speaker magnet results ina corresponding current in the sensing coil 944. Thus, if the speaker940 is operative, the alarm controller 310 (FIG. 3) can detect thesensing coil 944 current in the alarm function signal 352 uponactivation of the drive signal 312 (FIG. 3) and a corresponding tonegenerator input 901 to the speaker amplifier 924. Otherwise, an alarmmalfunction is determined and the alarm controller 310 (FIG. 3) respondsaccordingly.

FIG. 10 illustrates a pulse oximeter 1000 comprising a portableinstrument 1001 and a corresponding docking station 1002.Advantageously, when the portable instrument 1001 is docked, the pulseoximeter 1000 has redundant alarms 1050, 1070 that are activatedconcurrently so as to provide a robust alarm system. In particular,failure of one alarm does not silence an audible indication of ameasured parameter outside of preset limits, such as during adesaturation event. Further, concurrent activation of the alarms 1050,1070 provides a stereo-like directional resolution that allows acaregiver in a large ward to more readily locate the pulse oximeter andthe patient corresponding to the alarm.

As shown in FIG. 10, the portable instrument 1001 has a signal processor1020 in communications with a sensor 1010, a management processor 1030,a display 1040 and an alarm A 1050. The signal processor 1020 functionsin conjunction with the sensor 1010 to determine oxygen saturation,pulse rate and related parameters, as described above. These results arecommunicated to the display 1040 and alarm A 1050 via the managementprocessor 1030. The docking station 1002 has a processor 1060, an alarmB 1070 and various visual status indicators 1080. The portableinstrument 1001 and docking station 1002 communicate across a mechanicaland electrical interface 1005 via their respective processors 1030,1060. In particular, an alarm condition determined by the portable'smanagement processor 1030 is communicated to the docking stationprocessor 1060 for concurrent activation of alarms A and B 1050, 1070. Apulse oximetry comprising a portable instrument and a docking stationare described in U.S. Pat. No. 6,584,336 entitled Universal/UpgradingPulse Oximeter, which is assigned to Masimo Corporation, Irvine, Calif.and incorporated by reference herein.

A pulse oximeter having a robust alarm system is described above as acombination portable instrument and docking station having multiple,concurrently activated alarms. In other embodiments, a pulse oximeterhaving multiple, concurrently activated alarms may be a singlestandalone instrument, handheld or plug-in module, as further examples.A robust alarm system is also described above as having audible alarmtransducers and corresponding alarm detectors. In other embodiments, thealarms may be audible or visual or a combination of both and the alarmdetectors may be any of various optical devices for verifying operationof visual indicators or displays.

A robust alarm system has been disclosed in detail in connection withvarious embodiments. These embodiments are disclosed by way of examplesonly and are not to limit the scope of the claims that follow. One ofordinary skill in art will appreciate many variations and modifications.

What is claimed is:
 1. A patient monitoring device comprising: a drivingcircuit configured to drive one or more emitters; a front end processingcircuit configured to receive a signal from a detector responsive tolight from said emitters attenuated by body tissue; an alarm configuredto provide an alert to a caregiver; a processor responsive to said frontend to process said signal to determine one or more measurement valuesfor one or more physiological parameters of a patient being monitored,said processor also configured to trigger said alarm when one or more ofsaid measurement values should receive caregiver review; a malfunctionindicator providing an alert that said alarm was nonresponsive whentriggered by said processor.
 2. The monitoring device of claim 1,wherein said malfunction indicator comprises a buzzer.
 3. The monitoringdevice of claim 1, wherein said malfunction indicator comprises anaudible alert.
 4. The monitoring device of claim 1, wherein said alarmcomprises a sound transducer.
 5. The monitoring device of claim 1,wherein said alarm comprises a robust alarm.
 6. The monitoring device ofclaim 5, wherein said robust alarm comprises an electronic circuitcapable of determining whether said alarm was nonresponsive.
 7. Themonitoring device of claim 6, wherein the electronic circuit comprises adriver circuit driving said robust alarm and a tester configured todetermine integrity of a driver circuit.
 8. The monitoring device ofclaim 5, wherein said robust alarm comprises a plurality of soundtransducers.
 9. A method of indicating to a caregiver that an alarmsystem has failed without duplicating said alarm system, the methodcomprising: driving one or more emitters; processing a signal from adetector responsive to light from said emitters attenuated by bodytissue; a processor responsive to said front end to process said signalto determining one or more measurement values for one or morephysiological parameters of a patient being monitored, triggering analarm system when one or more of said measurement values should receivecaregiver review; providing an alert that said alarm system wasnonresponsive when triggered by said processor, said alert comprising anaudible alert.
 10. The method of claim 9, wherein said audible alertcomprises a buzzer.